Getting Data In

Palo Alto Syslog being Indexed, but not parsed

cklinkbeil
New Member

I saw the other forum posts, and they are not the same Issue i am having. I have configured the PA to directly send syslog's to the Splunk server. Its a single node deployment. I installed the Addon as well as the PA dashboard app. I am using the default syslog format of BSD with no custom formats.

I created a Pan_logs Index and a UDP data input on 5514, with a sourcetype of pan:log. I have also tried other source types such as pan:firewall, pan:traffic....etc

I can do a search on the index, and it comes up with all the syslog messages. The source type is pan:traffic from most of them. config changes come in with pan:config.

The index is configured with the App of the Addon

None of the data is being parsed into the dashboard. A search of eventtype="pan_firewall" yields no results.

What am I missing? I feel like its a Splunk config i need.

Tags (1)
0 Karma

cklinkbeil
New Member

To add to what I typed previously, when I search the index, it looks like the "sourcetype" is not being converted from "pan:config" to "pan_config"

all of the source types still have the ":" in them.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...